chore: harden CVE remediation summary rendering

Address review findings: escape backslashes before pipes in table cells,
fail loudly when the issues artifact is missing or malformed, exercise
note truncation in the tests, and scope the always() assertion to the
report step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VsjLedntEDA6nHFmfYYHAQ

Author: claude

.github/scripts/render-cve-remediation-summary.sh

@@ -13,8 +13,14 @@ NOTES_DIR="${2:?notes directory is required}"
 
 MAX_NOTE_LENGTH=500
 
+if ! jq -e 'type == "array"' "$ISSUES_FILE" >/dev/null 2>&1; then
+  echo "issues file '$ISSUES_FILE' is missing or is not a JSON array" >&2
+  exit 1
+fi
+
 escape_table_cell() {
-  printf '%s' "${1//|/\\|}"
+  local escaped="${1//\\/\\\\}"
+  printf '%s' "${escaped//|/\\|}"
 }
 
 echo '| Linear issue | Priority | Status | Title | Notes |'

.github/scripts/test-cve-remediation.sh

@@ -378,25 +378,46 @@ cat > "$RENDER_ISSUES_FILE" <<'EOF'
     "priority": 4,
     "status": "Backlog",
     "statusType": "backlog"
+  },
+  {
+    "id": "issue-35",
+    "identifier": "SOU-35",
+    "title": "[sourcebot-dev/example] CVE-35: truncated long note",
+    "url": "https://linear.app/sourcebot/issue/SOU-35/test",
+    "priority": 5,
+    "status": "Backlog",
+    "statusType": "backlog"
   }
 ]
 EOF
 printf 'Opened PR #99 upgrading foo to 1.2.3.\n' > "$RENDER_NOTES_DIR/SOU-31.md"
-printf 'No patched | release exists yet;\nre-check tomorrow.\n' > "$RENDER_NOTES_DIR/SOU-32.md"
+cat > "$RENDER_NOTES_DIR/SOU-32.md" <<'EOF'
+No patched | release \| exists yet;
+re-check tomorrow.
+EOF
 printf 'Skipped: dependency already patched on main.\n' > "$RENDER_NOTES_DIR/issue-34.md"
+LONG_NOTE=$(printf 'a%.0s' $(seq 1 600))
+printf '%s\n' "$LONG_NOTE" > "$RENDER_NOTES_DIR/SOU-35.md"
 
 EXPECTED_SUMMARY='| Linear issue | Priority | Status | Title | Notes |
 | --- | ---: | --- | --- | --- |
 | [SOU-31](https://linear.app/sourcebot/issue/SOU-31/test) | 1 | Todo | [sourcebot-dev/example] CVE-31: note keyed by identifier | Opened PR #99 upgrading foo to 1.2.3. |
-| [SOU-32](https://linear.app/sourcebot/issue/SOU-32/test) | 2 | Backlog | [sourcebot-dev/example] CVE-32: pipe \| in title | No patched \| release exists yet; re-check tomorrow. |
+| [SOU-32](https://linear.app/sourcebot/issue/SOU-32/test) | 2 | Backlog | [sourcebot-dev/example] CVE-32: pipe \| in title | No patched \| release \\\| exists yet; re-check tomorrow. |
 | [SOU-33](https://linear.app/sourcebot/issue/SOU-33/test) | 3 | Backlog | [sourcebot-dev/example] CVE-33: no note |  |
 | [SOU-34](https://linear.app/sourcebot/issue/SOU-34/test) | 4 | Backlog | [sourcebot-dev/example] CVE-34: note keyed by UUID | Skipped: dependency already patched on main. |'
+EXPECTED_SUMMARY+="
+| [SOU-35](https://linear.app/sourcebot/issue/SOU-35/test) | 5 | Backlog | [sourcebot-dev/example] CVE-35: truncated long note | ${LONG_NOTE:0:500}… |"
 
 assert_equals \
-  "renders the results table with flattened, escaped agent notes" \
+  "renders the results table with flattened, escaped, truncated agent notes" \
   "$("$RENDER_SCRIPT" "$RENDER_ISSUES_FILE" "$RENDER_NOTES_DIR")" \
   "$EXPECTED_SUMMARY"
 
+if "$RENDER_SCRIPT" "$RENDER_NOTES_DIR/does-not-exist.json" "$RENDER_NOTES_DIR" >/dev/null 2>&1; then
+  echo "FAIL: fails loudly instead of rendering an empty table when the issues file is missing"
+  exit 1
+fi
+
 assert_json \
   "maps Linear on-call assignees to GitHub reviewers" \
   "$(jq -c . "$REVIEWER_MAP_FILE")" \
@@ -478,15 +499,23 @@ assert_workflow_not_contains \
 assert_workflow_contains \
   "hands issue metadata to the remediation job through an artifact" \
   'name: cve-remediation-issues'
+assert_workflow_contains \
+  "uploads the issue metadata from the discovery job" \
+  'name: Upload issue metadata for the remediation summary'
+assert_workflow_contains \
+  "downloads the issue metadata in the remediation job" \
+  'name: Download issue metadata'
 assert_workflow_contains \
   "prompts Claude with the notes location for the run summary" \
   'cve-remediation-notes/<LINEAR-IDENTIFIER>.md'
 assert_workflow_contains \
   "renders the remediation results table after the agent runs" \
   '.cve-remediation-workflow/.github/scripts/render-cve-remediation-summary.sh'
-assert_workflow_contains \
-  "reports remediation results even when the agent step fails" \
-  'if: always()'
+if ! grep -A1 -- '- name: Report remediation results' "$WORKFLOW_FILE" | grep -Fq 'if: always()'; then
+  echo "FAIL: reports remediation results even when the agent step fails"
+  echo "Expected the 'Report remediation results' step to run with 'if: always()'"
+  exit 1
+fi
 assert_workflow_contains \
   "includes the agent notes column in the results table" \
   '| Linear issue | Priority | Status | Title | Notes |' \